lkml.org 
[lkml]   [2024]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open
Date
On Fri, 26 Apr 2024 05:00:21 -0700
> syzbot found the following issue on:
>
> HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53

--- x/fs/char_dev.c
+++ y/fs/char_dev.c
@@ -377,6 +377,9 @@ static int chrdev_open(struct inode *ino
struct cdev *new = NULL;
int ret = 0;

+ if (!igrab(inode))
+ return -ENXIO;
+
spin_lock(&cdev_lock);
p = inode->i_cdev;
if (!p) {
@@ -384,8 +387,10 @@ static int chrdev_open(struct inode *ino
int idx;
spin_unlock(&cdev_lock);
kobj = kobj_lookup(cdev_map, inode->i_rdev, &idx);
- if (!kobj)
+ if (!kobj) {
+ iput(inode);
return -ENXIO;
+ }
new = container_of(kobj, struct cdev, kobj);
spin_lock(&cdev_lock);
/* Check i_cdev again in case somebody beat us to it while
@@ -401,8 +406,10 @@ static int chrdev_open(struct inode *ino
ret = -ENXIO;
spin_unlock(&cdev_lock);
cdev_put(new);
- if (ret)
+ if (ret) {
+ iput(inode);
return ret;
+ }

ret = -ENXIO;
fops = fops_get(p->ops);
@@ -416,10 +423,12 @@ static int chrdev_open(struct inode *ino
goto out_cdev_put;
}

+ iput(inode);
return 0;

out_cdev_put:
cdev_put(p);
+ iput(inode);
return ret;
}

--
\
 
 \ /
  Last update: 2024-04-27 12:44    [W:0.716 / U:0.364 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site